mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
38902309f4
On an onion deployment Pixelfed's server-side code-to-token exchange dials the Keycloak .onion authority. libcurl refuses to resolve .onion names (RFC 7686) before /etc/hosts or the SSO extra_hosts pin is consulted, so the callback died with "cURL error 6: Not resolving .onion address" and both OIDC login specs timed out (Pixelfed#0, compose, Tor, PR #869 run 37954856725). Pixelfed builds its league/oauth2 GenericProvider without a proxy option, so the proxy has to come from the environment. When the issuer is an onion, env.j2 now sets http_proxy and https_proxy to the Tor socks5h endpoint, with the object store host in no_proxy. Both Pixelfed services pin host.docker.internal, the compose SOCKS endpoint, since the worker reads the same env file. Clearnet deploys render no proxy. Verified with a local compose deploy of variant 0 (SSO, seaweedfs, Tor): the rendered token URL is an .onion authority, the env carries socks5h://host.docker.internal:9050, and both pixelfed OIDC login specs pass. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
29 lines
2.0 KiB
YAML
29 lines
2.0 KiB
YAML
---
|
|
application_id: "web-app-pixelfed"
|
|
|
|
swarm_stack_converge_retries: 600
|
|
|
|
PIXELFED_CONTAINER: "{{ lookup('config', application_id, 'services.pixelfed.name') }}"
|
|
PIXELFED_WORKER_CONTAINER: "{{ lookup('config', application_id, 'services.worker.name') }}"
|
|
PIXELFED_TITEL: "{{ lookup('config', application_id, 'services.pixelfed.titel') }}"
|
|
PIXELFED_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
PIXELFED_OIDC_ONION_ISSUER: "{{ lookup('tls', 'web-app-keycloak', 'domain').endswith('.onion') }}"
|
|
PIXELFED_OIDC_SOCKS_PROXY: "{{ lookup('tor_socks_proxy') if PIXELFED_OIDC_ONION_ISSUER | bool else '' }}"
|
|
PIXELFED_NO_PROXY: "{{ ['localhost', '127.0.0.1', lookup('objstore', application_id, 'host')] | select | join(',') }}"
|
|
PIXELFED_APP_USER: "33"
|
|
PIXELFED_INSTANCE_DIR: "{{ lookup('container', application_id, 'directories.instance') }}"
|
|
PIXELFED_ENV_FILE: "{{ lookup('container', application_id, 'files.env') }}"
|
|
PIXELFED_ENTRYPOINT_FILE: "docker-entrypoint.sh"
|
|
PIXELFED_ENTRYPOINT_HOST_ABS: "{{ [PIXELFED_INSTANCE_DIR, PIXELFED_ENTRYPOINT_FILE] | path_join }}"
|
|
PIXELFED_ENTRYPOINT_DOCKER: "{{ lookup('volume', 'web-app-pixelfed', 'entrypoint').target }}"
|
|
PIXELFED_WORKER_ENTRYPOINT_FILE: "worker-entrypoint.sh"
|
|
PIXELFED_WORKER_ENTRYPOINT_HOST_ABS: "{{ [PIXELFED_INSTANCE_DIR, PIXELFED_WORKER_ENTRYPOINT_FILE] | path_join }}"
|
|
PIXELFED_WORKER_ENTRYPOINT_DOCKER: "{{ lookup('volume', 'web-app-pixelfed', 'worker_entrypoint').target }}"
|
|
PIXELFED_DB_NAME: "{{ lookup('database', application_id, 'name') }}"
|
|
PIXELFED_ADMIN_USER_KEY: "administrator"
|
|
PIXELFED_ADMIN_USERNAME: "{{ lookup('users', PIXELFED_ADMIN_USER_KEY).username }}"
|
|
PIXELFED_ADMIN_EMAIL: "{{ lookup('users', PIXELFED_ADMIN_USER_KEY).email }}"
|
|
PIXELFED_ADMIN_PASSWORD: "{{ lookup('users', PIXELFED_ADMIN_USER_KEY).password }}"
|
|
PIXELFED_ADMIN_NAME: "{{ (lookup('users', PIXELFED_ADMIN_USER_KEY).firstname ~ ' ' ~ lookup('users', PIXELFED_ADMIN_USER_KEY).lastname) | trim }}"
|
|
PIXELFED_ADMIN_OIDC_ID: "{{ PIXELFED_ADMIN_USERNAME }}"
|